Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Missing NULL check in `mtk_plane_duplicate_state` leads to a kernel panic if state allocation fails during reset. -- --- Patch [46]: [PATCH 46/60] drm/mediatek: Convert to atomic_create_state --- commit 867713cd832a2d719c2c0ff993878555b5315739 Author: Maxime Ripard <[email protected]> drm/mediatek: Convert to atomic_create_state The plane reset implementation creates a custom state subclass, but only initializes a pristine state without resetting any hardware. This is equivalent to what atomic_create_state expects. Convert to it. > diff --git a/drivers/gpu/drm/mediatek/mtk_plane.c > b/drivers/gpu/drm/mediatek/mtk_plane.c > index 2598c8edb443d..2a40d72d241e0 100644 > --- a/drivers/gpu/drm/mediatek/mtk_plane.c > +++ b/drivers/gpu/drm/mediatek/mtk_plane.c > @@ -25,26 +25,20 @@ static const u64 modifiers[] = { > DRM_FORMAT_MOD_INVALID, > }; > > -static void mtk_plane_reset(struct drm_plane *plane) > +static struct drm_plane_state *mtk_plane_create_state(struct drm_plane > *plane) > { > struct mtk_plane_state *state; > + state = kzalloc_obj(*state); > + if (!state) > + return ERR_PTR(-ENOMEM); [Severity: High] This is a pre-existing issue, but if mtk_plane_create_state() fails here during drm_mode_config_reset(), plane->state is left as NULL. When userspace later performs an atomic commit, does this lead to a NULL pointer dereference in mtk_plane_duplicate_state()? If we look at mtk_plane_duplicate_state() in the same file: struct mtk_plane_state *old_state = to_mtk_plane_state(plane->state); ... state->pending = old_state->pending; Since old_state is NULL, it looks like this will cause a kernel panic. Should a NULL check be added to mtk_plane_duplicate_state() to handle this case? > > - if (plane->state) { > - __drm_atomic_helper_plane_destroy_state(plane->state); > - > - state = to_mtk_plane_state(plane->state); > - memset(state, 0, sizeof(*state)); > - } else { > - state = kzalloc_obj(*state); > - if (!state) > - return; > - } > - > - __drm_atomic_helper_plane_reset(plane, &state->base); > + __drm_atomic_helper_plane_state_init(&state->base, plane); > > state->base.plane = plane; > state->pending.format = DRM_FORMAT_RGB565; > state->pending.modifier = DRM_FORMAT_MOD_LINEAR; > + > + return &state->base; > } [ ... ] -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=46
